Data Protection Law Suspended Due to Pandemic

A customer at Siam Paragon uses her phone to scan the QR code logging her visit with a government website on May 17, 2020.
A customer at Siam Paragon uses her phone to scan the QR code logging her visit with a government website on May 17, 2020.

BANGKOK — A law designed to protect personal information and increase liability for data handlers was deferred to another year due to the coronavirus outbreak, officials said.

According to a government decree published on Thursday night, nearly all organizations are exempt from most chapters of the Personal Data Protection Act until May 31, 2021.

The law was set to be enforced next Wednesday following a one-year grace period. The Cabinet said it wanted to give the public and private sectors more time to implement data protection measures required by the law, and ease their financial burdens caused by the COVID-19 crisis.

“We have to postpone it after receiving petitions from many sectors,” digital economy minister Buddhipongse Punnakanta said Tuesday. “The postponement would give more time for both the public and private sectors to adjust their systems, which can involve a  lot of spending.”

Advertisement

He also said that the law does not seek to steal personal information as online rumors suggested.

“I don’t want people to be concerned about this law,” Buddhipongse said. “I insist that it prevents personal information from being stolen according to an international standard. It doesn’t mean that we will use it to hack into people’s data.”

The legislation, which shares similar concepts to the European Union’s General Data Protection Regulation (GDPR), was passed by the junta-appointed lawmakers in 2019.

The law requires the data handlers to ask for consent from data owners, and safeguard the collected information in a secure manner, as well as requiring the handlers to use the data within defined purposes.

Advertisement

Under the law, data owners can also request access to their information, and order their data to be kept anonymous, or even removed.

Violators face up to one year of imprisonment or a maximum fine of 500,000 baht.

The government on Thursday night suspended almost all of the vital chapters, which include the rights of data owners and protection of personal data. Only provisions concerning the oversight committees are currently in effect.